PT-2025-38620
CVE-2025-9081
·
Published
2025-09-19
·
Updated
2026-10-19
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Mattermost versions 10.5.x through 10.5.8
Mattermost versions 9.11.x through 9.11.17
Description
Mattermost fails to properly validate access controls, allowing any authenticated user to download sensitive files. This is possible through the board file download endpoint using UUID enumeration.
Recommendations
Update Mattermost versions prior to 10.5.9.
Update Mattermost versions prior to 9.11.18.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾